Error tolerance of two-basis quantum key-distribution protocols using qudits and 

two-way classical communication 
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We investigate the error tolerance of quantum cryptographic protocols using d-level systems. In 
particular, we focus on prepare-and-measure schemes that use two mutually unbiased bases and a 
key-distillation procedure with two-way classical communication. For arbitrary quantum channels, 
we obtain a sufficient condition for secret-key distillation which, in the case of isotropic quantum 
channels, yields an analytic expression for the maximally tolerable error rate of the cryptographic 
protocols under consideration. The difference between the tolerable error rate and its theoretical 
upper bound tends slowly to zero for sufficiently large dimensions of the information carriers. 

PACS numbers: 03.67.Dd, 03.67.Hk 



I. INTRODUCTION 

Provable entanglement has been shown to be a nec- 
essary precondition for secure quantum key-distribution 
(QKD) in the context of any protocol 0,0- Recently 0, 
we investigated the maximal average disturbance (error 
rate) up to which the two legitimate users (Alice and 
Bob) of a QKD protocol can prove the presence of quan- 
tum correlations in their sifted classical data. In par- 
ticular, we focused on qudit-based QKD protocols using 
two Fourier-dual bases (to be referred to hereafter as 2d- 
state protocols). Under the assumption of arbitrary joint 
(coherent) attacks we showed that the threshold distur- 
bance for provable entanglement scales with the qudit- 
dimension d as 



D th (d) 



2d 



(1) 



This theoretical upper bound on tolerable error rates 
for 2<i-state protocols is valid for arbitrary dimensions, 
provided that Alice and Bob focus on their sifted key and 
do not apply any collective measurements on their halves. 
Its implications are obvious for estimated disturbances 
above D t h namely, Alice and Bob are not able to infer 
whether the correlations in their data have originated 
from an entangled state or not, and the protocol must be 
aborted. However, for detected disturbances below -Dth, 
the picture is incomplete. In particular, based on the 
above result we only know that the two honest parties can 
be confident that they share provable entanglement with 
high probability. Thus, the necessary precondition for 
secret-key distillation is satisfied for disturbances up to 
D t h- Nevertheless, the details of a prepare-and-measure 
(P&M) scheme which will be capable of attaining this 
theoretical bound are unknown. In fact, it is not at all 
clear whether such a P&M scheme exists. 

So far, the highest tolerable error rates in the frame- 
work of P&M QKD schemes have been reported for pro- 
tocols using a two-way Gottesman-Lo-type procedure for 
key distillation \£. This procedure was introduced and 
improved in the context of the standard qubit-based 
(d = 2) QKD protocols 0, 0. It is based on local 



quantum operations and two-way classical communica- 
tion (LOCC2) and is able to provide the two legitimate 
users with an unconditionally secure key up to high er- 
ror rates. In particular for the standard 4-state qubit- 
based protocol (BB84) the tolerable error rate is 20% 
0, |(| which is well below the corresponding theoretical 
upper bound given by Eq. JTJ, that is 25%. The natural 
question arises therefore whether this gap still persists 
for higher dimensions (d > 2) and, in particular, how it 
scales with the dimension d of information carriers. 

Recently, extending the Gottesman-Lo two-way key 
distillation (GL2KD) procedure to higher dimensions, 
Chau addressed this open question in the context of fully- 
symmetric qudit-based QKD schemes using all (d + 1) 
possible mutually unbiased bases Q- More precisely he 
showed that if d is a prime power, the tolerable error-rate 
scales with dimension as 1 — (3 + \^5)/2d, for d — > oo. 

In this paper, our purpose is to analyze the error toler- 
ance of 2e?-state QKD protocols using a GL2KD process. 
In contrast to the protocols considered in 0, the proto- 
cols considered here are not necessarily fully symmetric. 
In general, we have only one symmetry constraint i.e., the 
symmetry between the two Fourier-dual bases used in the 
protocol. Hence, the problem in its most general form is 
analytically solvable to some extent only. Specifically, 
we are able to derive a sufficient condition for secret- 
key distillation in which the number of open parameters 
scales quadratically with d. However, the derivation of 
an analytic expression for the tolerable error rate is pos- 
sible under additional symmetry assumptions related to 
isotropic quantum channels. In this case, we find that 
the asymptotic (d — > oo) tolerable error-rate scales with 
dimension as 1/2— 1/4 *Jd, and slowly approaches there- 
fore its theoretical upper bound determined by Eq.Q), 
that is 1/2. 

The organization of the paper follows the three phases 
of a typical P&M QKD scheme. In Sec. [HJ for the sake of 
completeness we briefly summarize basic facts about the 
first two phases of a 2<i-state QKD protocol, i.e., quantum 
state distribution and verification test. Subsequently, in 
Sec. 11111 we focus on the key-distillation phase which is 
the main subject of this work. In particular we con- 
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sider a GL2KD procedure. Our analysis is based on the 
entanglement-based version of the 2d-state QKD proto- 
col, whose reduction to a P&M scheme is summarized 
at the end of the section. An analytic expression for 
the tolerable error-rate is derived in Sec. IIVI under the 
assumption of isotropic quantum channels. Finally, we 
conclude with a short summary and outlook in Sec. [V] 



II. THE FIRST TWO STAGES OF TWO-BASIS 
QKD PROTOCOLS 

For the sake of simplicity, and without loss of gen- 
erality, we will focus on prime dimensions only. Thus, 
throughout this work all the arithmetics are performed 
in the finite (Galois) field ¥ d = {0, 1, . . . , d - 1} 0. It 
has to be noted, however, that similar arguments hold if 
d is a prime power but the formalism is more involved 
(e.g., see 0). 

In general, theoretical investigations of d-level quan- 
tum systems (qudits) are performed conveniently with 
the help of the generalized Pauli operators 

SUn—J^J-nJII-mXil for m,ne¥ d , (2) 

where $(x) = exp(i^ip). These d 2 operators form a 
faithful projective unitary representation of (Z\cK) x 
(Z\cE) and an error basis on the Hilbert space of a qudit 
C d @. 

In a typical 2d-state P&M scheme, Alice and Bob use 
for th eir purp oses two mutually unbiased bases. Follow- 
ing 0, El UJ$ > throughout this work we choose the eigen- 
basis { | a) : a £ F,j} of 2loi as the standard (computa- 
tional) basis Bi, while the second basis B2 is the Fourier 
dual of the computational basis with the discrete Fourier 
transformation given by 

$■■=^2 E a(i-i)l*><7|. 

Hence, the indices m and n in Eq. @, refer to dit-flip 
and phase errors in the standard basis Bi, respectively. 
Moreover, &%mn$ = $(— m-n)2l* TO which indicates that 
dit-flip errors in the computational basis become phase 
errors in the complementary basis and vice-versa. 

In general, the first stage of a QKD protocol is the 
quantum state distribution stage which involves quan- 
tum state (signal) preparation and transmission via an 
insecure quantum channel. The purpose of this phase is 
to establish correlations between Alice and Bob, which 
may also involve correlations with a third untrusted 
party (eavesdropper). As far as a typical 2d-state P&M 
scheme is concerned, this first stage proceeds as follows 
01 Ei! Ell • Alice sends to Bob a sequence of qudits 
each of which is randomly prepared in one of the 2d non- 
orthogonal basis-states (d states for each basis). Bob 
measures each received particle randomly in B\ or #2. 



Alice and Bob publicly discuss the bases chosen, discard- 
ing all the dits where they have selected different bases 
(sifting). 

Generalizing the ideas presented in |12( , the aforemen- 
tioned state-distribution process can be viewed as follows 
PI 0) EH [HI • Alice prepares each of N » 1 entangled- 
qudit pairs in the maximally entangled state l^oo)- 
Thereby, the generalized maximally entangled states in 
the Hilbert space of two distinguishable qudits <£> Cg 

are defined as |* mn ) := X^; G F d Ua) <8> %mn\jB)/Vd, 
where from now on the subscripts A and B refer to Al- 
ice and Bob, respectively 0, E3 EH EH E3 • Alice keeps 
half of each pair and submits the other half to Bob after 
having applied at random and independently, a unitary 
transformation chosen from the set {l,^}. As soon as 
Bob receives the particles, he acknowledges the fact and 
applies at random 1 or S^ 1 on each qudit independently. 
Alice reveals the sequence of operations she performed 
and all the pairs which involve different operations on 
the transmitted qudit are discarded. This is the asso- 
ciated entanglement-based (EB) version of the 2<i-state 
QKD protocol and offers many advantages, in particular 
with respect to security issues and error tolerance. 

The second stage of the QKD protocol is the verifica- 
tion test (also called signal-quality test) which we dis- 
cussed in detail elsewhere pg. In this stage, the two 
legitimate users sacrifice part of their (quantum) sig- 
nal in order to quantify the eavesdropping rate during 
the transmission stage. More precisely, after a random 
permutation of their sifted (qu)dit pairs, Alice and Bob 
randomly select a sufficiently large number of them and 
determine their average error probability (disturbance). 
If as a result of a noisy quantum channel (from now on 
all the noise in the channel is attributed to eavesdrop- 
ping) the estimated disturbance is too high, the protocol 
is aborted. Otherwise, Alice and Bob proceed to the key- 
distillation phase which will be discussed in detail in the 
following section. 

At any rate, it is always worth keeping in mind that 
the success of the verification test (and thus security) 
relies on two key points. First, an eavesdropper does 
not now in advance which qudit-pairs will be chosen for 
quality checks and which qudit-pairs will contribute to 
the final key. Second, any joint eavesdropping attack can 
be reduced to a classical (probabilistic) cheating strategy 
for which classical sampling theory can be safely applied 

BEzLmp. 

In particular, the action of the quantum channel can 
be regarded as a Pauli one 0,0. At the end of the dis- 
tribution stage of the 2d-state protocol, each transmitted 
qudit may have undergone any of the d 2 possible types 
of errors 2l m „ . Let p mn denote the rate (probability) of 
errors of the form 2l mn in the particles shared between 
Alice and Bob, with 

E Pmn = 1- (3) 
In general, any symmetries underlying the QKD proto- 
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col under consideration may imply additional constraints 
on p mn . For the protocols under consideration, both 
Fourier-dual bases are used at random and independently 
on each qudit-pair during the transmission. Moreover, 
the choices of the bases are not known to an eavesdrop- 
per, and they are publicly announced only after all the 
particles are in Bob's possession. Thus, as a result of the 
symmetry between the two bases, the quantum channel 
connecting Alice and Bob yields different sets of identical 
error-probabilities 0. In particular, we have that 



Pr, 



Pn,d- 



: Pd-m,d-n = Pd-n,m, Vm, n G ¥ d . (4) 



Note that in highly symmetric protocols, the correspond- 
ing symmetry between all {d+l) mutually unbiased bases 
leads to a depolarizing quantum channel with p mn = poi 
for all (m,n) ^ (0,0) jf. 

In view of the symmetries (@J, the estimated distur- 
bance during the verification test is given by 



D 



E 

mEF* 



PmO 



E Eft 

meF * n <EF* 



(5) 



where := Fd\{0}. This estimated error rate should 
not be confused with the so-called quantum-channel 
(overall) error rate Q = 1 — poo, which is not estimable in 
a typical verification test of a P&M 2d-state QKD pro- 
tocol. 

At this point, we have all the necessary formalism 
and we turn to investigate the error tolerance of 2d-state 
P&M protocols. 



III. ANALYSIS OF THE TWO-WAY KEY 
DISTILLATION 

Throughout this work we focus on the GL2KD proce- 
dure in the context of which the highest tolerable error 
rates have been reported for various P&M QKD schemes 
IE 0- O ur purpose is to investigate the conditions 
under which an insecure quantum channel allows the dis- 
tillation of a secret key in the context of 2d-state QKD 
protocols and the GL2KD procedure. Such an analysis 
can be performed conveniently in the EB version of the 
protocols we described in the previous section and adopt 
from now on. We will close this section with the reduc- 
tion of the EB scheme to a P&M one. 



A. Dit-flip error rejection (DER) 

As any other key-distillation process, the GL2KD has 
two stages 0, S ■ The first stage is a typical two- way 
entanglement purification with LOCC2 |13l fl4L 1171 llq . 
More precisely, in order to reduce the dit-flip-error rate in 
their signal Alice and Bob apply a number of D-steps. In 
each D-step, they form tetrads of particles by randomly 
pairing up their qudit-pairs. Then, within each tetrad 
of particles they apply a bilateral exclusive OR (BXOR) 



operation. Specifically, Alice and Bob individually apply 
to their halves the unitary operation 



XOFL 



\x) c ® \x- y) t , 



(6) 



where c and t denote the control and target qudit, respec- 
tively. Subsequently, they measure their target qudits 
in the computational basis and compare their outcomes. 
The control qudit-pair is kept if and only if their out- 
comes agree, while the target pair is always discarded. 

In general, this procedure is repeated many times 
(many rounds of D-step) until the dit-flip-error rate in 
the surviving qudit-pairs is sufficiently low to guaran- 
tee an arbitrarily small total error rate at the end of 
the key-distillation protocol. We are going to make this 
statement more precise later on. For the time being, we 
turn to analyze the effect of the D-steps on the signal 
shared between Alice and Bob. 

Following 0, j our analysis will be based on classi- 
cal probability arguments since any eavesdropping attack 
can be reduced to a classical probabilistic one. In partic- 
ular, let S = {pmn\ ra,n G ¥ d } be the set of error rates 
(error-probability distribution) at the beginning of DER 
(i.e., at the end of the first stage of the QKD protocol). 
It has been shown that the effect of k rounds of D- 
step (with k 6 N) on S can be identified by a mapping 

V k : S i-> Sk, where S k = {pmh\ m,n£ ¥ d } and 



p(*0 

i run 



EieF $(-™-0 E j&d ®( l ■ 3) Pmj 



Pij 



(7) 



One can readily check that by setting d — 2, this map- 
ping reduces to the well-known mapping for qubit-based 
protocols 0,0. 

Clearly, p£i* = since the summations in Eq. Q 
run over all the finite field F^. Furthermore, for the same 
reason, Eq. Q can be rewritten as 



i inn 



[C{m)f +J2 len H-l-n)[A(m,l)Y 



d 



where 



A(m, I) 
C{m) 



l + E* eF! [C(Z)] 2 



EjgF, ®( l ■ j)Pr> 

EjSF„ POj 
EjGF d Pmj 
EjeFd POj 



; (8) 

(9a) 
(9b) 



for m, I G Frf. 

From now on we restrict ourselves to estimated distur- 
bances D < D t h, since for D > D t h Alice and Bob do 
not share provable entanglement 0, SB- Furthermore, 
for D < D t h we also have 



POn > Pmn V TO G ¥* d , 

ne¥ d nGF d 



(10) 
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(fe) 



E E 

Pvnn 



(lla) 



mGF * nGF d 



and 



T(0,0 = 



which implies that < C(m) < 1,V m £ Fj. Besides, a have that 

(k) 

necessary condition for < p m n < 1 after many rounds 
of D-step is |A(m, l)\ < 1, for all m,l € F f /. Thus, as 
k — > oo, we have |vl| 2 — > and |C| 2 — ► which imply 

that — > 1/d and — ► 0, for m, n e and m 7^ 0. 
In other words, the main effect of DER on the surviving 
particles shared between Alice and Bob is to reduce errors 
of the form 2l mn with m 7^ 0, while increasing the rate 
of pure phase errors of the form 2lon with n 7^ 0. 
In particular, let 



Poo 



T(m,l) 



25ft 



[dm 
3=1 

j'eF d 



form 7^ 0. 



where 3?(x) denotes the real part of In view of Eq. 
iJTSJ, Eq. (I14|) now follows immediately from the in- 
equality £q > Cn^ as a consequence of the fact that 
cos(a;) < 1, Va; G Fj. A similar but more involved calcu- 
lation can be performed if d is a prime power. ■ 



4 fe) = E E *8& - E * 



(nb) 



mGF d nGFJ 



be the total dit-fiip- and phase-error rates after k rounds 

(k) 

of D-step, respectively. As k — > 00, Rf^ — > whereas 

i?p^ — > (d — \)/d. We must therefore have a closer 
look at the corresponding individual phase-error rates 
which, using Eq. Q, are given by 



q W 



(ft) 

in a 



i 



(ft) 



mGF d 

for all n E Fd, where 



d d[l + X (k) ] 



£i fe) = E E*H-«)[^K0f 



X 



(12) 

(13a) 
(13b) 



mGF* 



Clearly, the parameters ^i' C ' ) and also take arbitrarily 
small values as k — » 00, since |A| 2 " ^Oand |C| 2 " -»• 0. 

Observation 1. The phase-error rates after fc rounds of 
D-step satisfy the inequality 



q { k, >qW VneF* d , 



(14) 



(ft) 

where qg is the no-phase-error probability. 

Proof. First of all, recall that throughout this work we 
assume prime dimensions only. Starting from Eq. (|12H . 

we have to show that S,^ > , for all n 7^ 0. Using 
the symmetry condition J2J, Eq. I|13a|l reads 

2El d £o J El5 1 2J cos(J.n)T(m,0 



(ft) 



SjGF d P0j 



Vn e F d , 



(15) 



where all T(m, Z) are real and positive. In particular, we 



B. Phase error correction (PEC) 

Assume now that Alice and Bob have applied a DER 
process involving many (fc 3> 1) rounds of D-step. As we 
have just discussed, at this point the dit-flip-error rate 
in their surviving pairs will be negligible (i.e., £ — 
for m 7^ 0), whereas the phase-error rate has possibly 
increased. It is therefore reasonable that the second stage 
of the GL2KD (usually called privacy amplification) deals 
with phase error correction (PEC) |j,|a,l3- 

In general, at the beginning of the PEC we have a d-ary 
asymmetric channel with respect to phase errors. In par- 
ticular, we have [d— 1) possible phase errors with corre- 
sponding probabilities (rates) q^f > given by Eq. I|12l) . To 
correct the phase errors, Alice and Bob apply an [r, 1, r\& 
repetition code with a relative majority-vote decoding 
PI. The key point is that, according to inequality lfTl|l . 
the necessary condition 8] for such an error correction to 
work is satisfied at the end of the DER process. 

For the sake of completeness, let us briefly summarize 
the main steps of the PEC procedure jj, Oj Ld] ■ Alice and 
Bob randomly divide their qudit-pairs into sets (blocks), 
each containing r qudit-pairs. Within each block, they 
perform a discrete Fourier transform 3 a <8> 3b on each 
pair. Subsequently, they perform a sequence of (r — 1) 
BXOR operations with the same control pair (say the 
first one) and targets each one of the remaining pairs. 
For each target pair, they measure their corresponding 
halves and estimate the parity of their outcomes. Finally, 
they apply 3a* ® 3b* on the control pair and Bob per- 
forms 2los on his control-qudit, where s £ F^ is the par- 
ity corresponding to the relative majority of their (r— 1) 
outcomes. If the relative majority of the outcomes is am- 
biguous, Bob applies 2loo- in this way, each block may 
result in one phase-error- free qudit-pair at most. 

Our task now is to investigate the effect of such a PEC 
process on the signal shared between Alice and Bob. Let 
us denote by p^ n the various error rates in the remaining 
qudit-pairs at the end of the process. We are mainly 
interested in the corresponding total dit-fiip- and phase- 
error rates. 
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1. Phase-error rate 



Let us start with the estimation of an upper bound on 
the total phase-error rate R P = Y^ m Z)n^o Pmn °f tne 
signal at the end of PEC. We are basically interested in 
the limit of large block-lengths r, that is in the limit of a 
large number of distributed qudit-pairs. 

Before we proceed further, it is worth noting that the 
problem under consideration belongs to a well known 
class of stochastic processes, the so-called occupancy 
problems or Balls-and-Bins experiments. In this pic- 
ture, our problem can be viewed as a probabilistic ex- 
periment where r balls (qudit-pairs) are randomly dis- 
tributed among d different (error-)bins. This class of 
problems is fundamental to the analysis of randomized 
algorithms and has been extensively studied in the lit- 
erature (e.g., see ^JUIIE]])- A particularly useful re- 
sult in this context are the so-called Chernoff-Hoeffding 
bounds which are basically large-deviation estimates. 
In general, these bounds are applicable to sums of neg- 
atively associated, identically distributed random vari- 
ables. Their precise derivation can be found in various 
papers and standard textbooks (e.g., see pol . l2il . l22L |23| ) . 

Observation 2. The phase-error rate in the surviving 
pairs at the end of PEC satisfies the condition 



*p<£ 




(16) 



where \J is the logical OR operator. The next step now 
is to upper bound each of the probabilities P (r]j > rjo) 
appearing in the last summation. 

Let us focus on a particular term, say P (r)i > 770) - We 
will work with the radom variables T]i, r/o and r) Ies t, where 
Vi + Va + Vrcst = r and 77 rcst = Y,jg{o,i} Vj- Accord- 
ingly, the corresponding probability distribution of inter- 
est is (go,9i,9rost) with qi + q + q icst = 1. Obviously, 
(r?o, r\i, r] Tes t) have a trinomial distribution which is given 
by 



f (%)%,»7rest) 



E 

r7rest=0 



^rost 



TJrest 
yrcst 



E 



WO Vi 

% 1i 



where r, = 770 + r)i = r — r) rcst . Introducing the new 
normalized probabilities qi = qi/(qo + qi) with I G {0,i}, 
the trinomial distribution can be rewritten as 



E " )?ST(9b + ?i) r -" 1 



e (;:)« 

.7)4=0 



Proof. Clearly, we have that Rp is upper bounded by 
the probability of failure for the repetition code Pf a ;i. It 
suffices therefore, to estimate an upper bound on Pf a ii. 

As we mentioned before, PEC is applied on a particular 
asymmetric channel with phase-error rates qo > qj for 
all j ^ (to simplify notation throughout this proof 
we write qj instead of Qj ). Let us denote by r\j the 
total number of qudit-pairs within a block of length r 
suffering from phase errors of the form 2l mj -, with m € F<j. 
Clearly, majority voting fails only if r\j > 770 for some 
j ^ 0, where 770 denotes the number of error-free pairs in 
the block. For asymmetric channels satisfying Eq. (|14fl . 
this may occur for sufficiently large deviations of rjj from 
their mean values. In particular, we expect for the failure 
probability of the majority-vote decoding, 



Note now that the expression in the brackets is the well 
known binomial distribution involving the two events of 
interest, i.e., the event of phase-error i, and the event of 
no- phase-error. In particular, for a given 77 res t the prob- 
ability that rji > 7] is given by 



P {Vi > Vo I Vic 



E 



r?i=rn/21 

< (4W* /2 = 



4<?o<?i 



{qo + qi) 2 



l"i/2 



Pfail < P 



V ^ 



> 



< 



2^ P(vj>m) 



(17) 



The above inequality is the well-known Chernoff- 
Hoeffding bound for the binomial distribution [2j| , which 
also applies here since qo > ft V i € FjJ. Thus, in total we 
have 
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< 



E 

^rost=0 

r 

E 

^rost=0 



?7i'cst 



??rest 



e s ?(l-5re 8t ) r - W Pfe>% I ?7rest) 



g^p(l-w) r - nB 



r 



(go + ft) 2 



(r-j7 rMt )/2 



(18) 



Finally, given that i?p < Pf a ii, inequality (|16fl is obtained 
from the condition (|*P7Jl . by using inequality l(T%)) and the 
identity EI =0 - p) r -°^- Q = \p + (1 - p)af. ■ 

According to observation 2, the phase-error rate in the 
signal after PEC decreases exponentially in the block- 
length r. If we are not interested on a tight upper bound 
on i?p, we may upper-bound the right-hand side of this 
condition as follows 




(19) 



where = max ^qffi | n 6 j, while equality in the 

latter part holds if and only if = g~ , Vn £ ¥* d . 
Although this last step is not at all necessary it consid- 
erably simplifies the subsequent notation and discussion. 

Recall now that the quantities and become 
arbitrarily small as k — > oo. Thus, in view of Eq. (|12|l . 
Eq. (|19|) may further simplified to 



R P < (d- 1) 



r 



(fc) 



Jk) 



Ad 



0(3) 



where 0(3) denotes third-order terms in , an d 

(k) 

£q . Inclusion of such higher-order terms may only 
lead to negligible corrections in the argument of the ex- 
ponent. At any rate, the phase-error rate will always 
be upper-bounded by a quantity which decreases expo- 
nentially fast in r. Alternatively, using the inequality 
(1 — x) r < exp(— rx) for all x < 1, we obtain 



R P < (d- l)exp 



Jk) _ Ak) 

SO Sfi 



(20) 



We turn now to estimate the corresponding dit-flip-error 
rate in the signal. 



gates the dit-flip errors propagate backwards from the 
target to the control qudit. As a result, at the end of 
the PEC the dit-flip-error rate in the remaining particles 
increases by at most r times (the control qudit-pair itself 
may initially suffer from a dit-flip-error), i.e., 



= E - r E E p 



(21) 



mGFJ n£¥ d 



According to the preceding discussion the net effect of 
the PEC is to reduce any phase errors of the form 2t m „ 
with n / 0, while possibly increasing dit-flip errors of 
the form 2t m0 with m ^ 0. Thus, at first site, the whole 
situation seems to be a vicious circle since PEC tends 
to destroy what was achieved in DER and vice-versa. A 
way out of this stumbling block relies on the judicious 
combination of DER and PEC. 



C. A judicious combination of DER and PEC 

For a given 2rf-state protocol (i.e., for a fixed d) Al- 
ice and Bob agree in advance upon a fixed and arbitrar- 
ily small security parameter e > 0. They apply many 
rounds (k ^ 1) of D-step, until there exists an integer 
r > such that a single application of the PEC will bring 
the quantum-channel error rate in the finally surviving 
pairs to values below e. Clearly, the protocol has to be 
aborted if the estimated integer r exceeds the number of 
remaining pairs immediately after the DER procedure. 
More precisely, at the end of DER, Alice and Bob may 
choose the block length for the repetition code to be 



2 SmeF* Y^nefd P 



W =2 U 



Note that for this particular choice of the block-length, 
t — ► oo as k — > oo . 

The key point now is that for such a choice of r, the 
overall channel error rate Q = 1 — pg can be upper- 
bounded as follows 



2. Dit-flip-error rate 

As we mentioned before, the PEC involves (r — 1) 
BXOR gates in the complementary basis. During these 



Q < Ru + Rp 



< - + (<f-l)exp 



(fc) 



d X W 



, (23) 
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where inequalities (|21(l and l|20(l have been used. Thus, 
for any given dimension of the information carriers, Q < e 
provided that 



?0 ?n 



(fc) 



> - In 

e 



2(d- 1) 



(24) 



As long as Q < e, Alice and Bob share a number of nearly 
perfect pairs whose fidelity with respect to the ideal state 
| M/oo } is exponentially close to one. The final key can then 
be obtained by measuring each pair separately along the 
standard basis, and the information that an eavesdropper 
may have on it, is also upper bounded by the security 
parameter e. 

The condition l|24|) is a sufficient condition for secret- 
key distillation in the context of 2d-state QKD protocols 
using two Fourier-dual bases. In particular, it determines 
the error rates which can be tolerated by such protocols 
using a GL2KD procedure. From that point of view, it is 
a generalization of the corresponding condition for fully 
symmetric qudit-based protocols obtained by Chau ■ 

Unfortunately, the number of independent parameters 
in inequality (|2"1|) scales quadratically with d, and thus 
an analytical (or even numerical) solution becomes rather 
difficult for d > 3. Hence, in order to obtain an analytic 
expression for the tolerable error rate for arbitrary di- 
mensions we had to resort to isotropic quantum channels. 
The related results will be discussed in detail in Sec. IIVI 
For the time being we close this section by summarizing 
the main points in the reduction of the EB version of the 
2d-state QKD protocol to a P&M one. 



D. Reduction to a P&M QKD scheme 

In general, not every EB QKD protocol can be reduced 
to a P&M one. The main difficulty appears in the reduc- 
tion of the underlying quantum key-distillation procedure 
to a purely classical one. The advantage of the GL2KD 
is that by construction it allows for such a reduction £| . 

The reduction of the EB 2c?-state QKD protocol to a 
P&M one, which tolerates precisely the same error rates, 
follows the same steps as for other protocols 0, 0, El • 
Here, for the sake of completeness, we would like to 
summarize the four cornerstones of such a reduction. 
First, during the distribution stage, Alice can measure 
all the halves of the pairs before sending the other halves 
to Bob. This is equivalent to choosing a random dit- 
string and encoding each dit in the corresponding qudit- 
state, in one of the two Fourier-dual bases. Second, 
the XOR operation used in the quantum key-distillation 
procedure can be easily replaced by its classical ana- 
logue. Thus, the DER stage is immediately reduced to a 
classical error-rejection (advantage distillation) process. 
Third, the quantum circuit of the PEC can also be re- 
duced to a classical one. Such a reduction relies on the 
fact that the sequence of gates applied independently by 
Alice and Bob in each block of r qudits during PEC, 



i.e., 1 (XORi^,- . . . XORi^2) ®j=i -Sj, is equivalent to 
<8>i= 2 3J 1 (XOR^J . . . XOR^i) . This equivalence fol- 
lows by induction from the fact that for any two qudits, 
(3- 1 ®lt)XOR c ^ t (&:®&) = (l c ® xor££, 
where XOR^ t : |x) c <E> \y)t >-> \x) c ® \x + y}t- Finally, 



the last essential point in the reduction is the observation 
that the key-distillation procedure does not rely on phase 
information. 

The above steps lead to a P&M 2c?-state QKD proto- 
col with the distribution and the verification-test stages 
discussed in Sec. \n\ The corresponding classical key- 
distillation stage of the protocol proceeds as follows 

DER: Alice and Bob perform many rounds of D-step. 
In each round they randomly form tetrads of their dits. 
For each tetrad j, Alice announces the parity of her dits, 



i.e., she announces — X^" , where X^" denotes the 
i-th pair of tetrad j. Similarly, Bob announces the parity 

(i) (i) 

of his corresponding dits — Y 2 ; . One of the dit-pairs 
(sayXp } smdY^) survives if and only if the announced 
parities agree. This process is repeated (many rounds of 
D-step) , until there is an integer r > such that a single 
application of the following phase-error correction will 
bring the overall error rate in the remaining signal below 
e. The protocol is aborted if the estimated parameter r 
exceeds the number of remaining dits. 

PEC: In the classical PEC (which is essentially privacy 
amplification), Alice and Bob randomly divide their re- 
maining dit-pairs into blocks each containing r dit-pairs. 
Let us denote by (X^' ,Y^) the i-th dit-pair in block 
j. Alice and Bob, replace each block by the parity of its 



U) 



-(./) 



dits, i.e., by Yh=i^I an d ELi^ . respectively. In 
this way, the final secret key essentially consists of the 
estimated parities for each one of the blocks. 

In closing, it has to be noted here that for a more effi- 
cient secret-key distillation the two legitimate users may 
follow the adaptive key-distillation procedure introduced 
by Chau H0. The main difference is that Alice and Bob 
do not apply many rounds of D-step and PEC in order to 
bring the overall error rate below the security parameter 
e. Instead, they simply adjust their DER and PEC in 
order to bring the overall error rate below, let us say 5%. 
From that point on, they switch to more efficient error- 
correction and privacy amplification using concatenated 
Calderbank-Shore-Steane codes. 



IV. ISOTROPIC QUANTUM CHANNELS 

An isotropic channel is characterized by poj = Pjo = 
Pio and pij = pji = pn for i,j £ FJ. It turns out that 
isotropy is an inherent property of the two-basis protocols 
using qubits (standard BB84) or qutrits Q. However, 
in general for 2c?-state protocols using higher dimensions 
(d > 3), isotropy cannot be justified so easily, unless 
the quantum channel itself is isotropic (e.g., open-space 
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quantum cryptography). 

The robustness and security of various QKD proto- 
cols under the assumption of isotropic eavesdropping 
has been extensi vely studied in the QKD literature 
HSmHIHIHEj- In particular, we know that at any 
rate the isotropy assumption does not affect the threshold 
disturbance for secret-key distillation which, for 2d-state 
protocols, is given by Eq. 10 j|. In this section, our 
purpose is to further analyze the sufficient condition for 
key distillation l|24[l in the framework of isotropic quan- 
tum channels and derive an analytic expression for the 
tolerable error rate of 2d-state QKD protocols. 

Instead of isotropic channels, we may consider a 
slightly more general class of channels for which poj ^ 
Pjo, that is 



( Poo Poi ■■■ Poi \ 

Pw Pll ■■■ Pll 
\ PW Pll ■■■ Pll j 



(25) 



Given the normalization condition such a channel in- 
volves three independent parameters and thus the deriva- 
tion of an analytic expression for the tolerable error rate 
is possible. Moreover, by setting p i = p w we can easily 
obtain the corresponding expressions for isotropic chan- 
nels. 



A. Tolerable error rates 

For channels satisfying Eq. I|25|) , Eq. (JSJ) yields for the 
probabilities after fc rounds of D-step 



(fc) 

Poo = 


[Poo - 


h(d- 


l)poi?" + {d- 


l)(Poo - 


POI? 






d n 






(fc) 

POn = 


[Poo - 


h(d- 


l)poi] 2 - Ooo 










d n 




1 


(fc) 
PmO ~ 


[Pio - 


h(d- 


l)Pii] 2 * + (d- 


l)(Pio- 


Pll) 2 






d n 






p (fc) = 


[Pio - 


h(d- 


l^n] 2 " - (Pio 


-Pllf 








d n 







where n = [p 00 + (d- l)poi} 2 " + (d- l)[pio + (d- l)pii} 2 " . 
In view of these relations, the form (|25|) is invariant under 

D-steps since we have that p^ = Pqi , Pmb = Pio an< ^ 
Pmn = Vm,n ^ 0. Therefore, all the phase-error 

rates q^f 1 with n ^ 0, are equal at the end of DER and the 
corresponding quantum channel is therefore symmetric 
with respect to phase errors. 

As in the previous section, we may also introduce the 
parameters A(m, n) and C(m). In fact, for the particular 
class of channels under consideration A(m, n) = A(m) for 



all m £ ¥<i and 



A(0) = 



Poo - Poi 



A(m) = A(l) = 



Poo + (d- l)poi ' 

Pio -pn 



Poo + (d - l)poi 



(26a) 

for m ^ 0, (26b) 



C(m) = C(l) = P^ + (d ~^Pii for m + 0j (26c) 
poo + \ d - 1 jpoi 

while C(0) = I . To proceed further, we note that A(m) = 
B(m)C(m), where 



B(m) 



PmO — Pml 
PmO + (d- l)p m l 



(27) 



and [B(m)] 2k — > 0, as fc — > oo. Thus, using Eqs. ij26*|) 
and J57J, Eqs. I|13|) can be simplified to 



e k) = (d-i) E i A ( m )Y 



e 



(fc) 



m£¥ d 

- E [Mm)?" for n ^0, 

meld 

X {k) = (d I) [C(l)f, 



(28a) 
(28b) 
(28c) 



where 



= [A(0)f + (d-l)[B(l)C(l)f.{29) 
Accordingly, condition (|24|l now reads 

d{[A(0)f +(d-l)[B(l)C(l)f} 2 g r 2(d _ 1} 
( d _i)[C(i)]2* >7 ln [^^~ 

or equivalently [setting A = A(0), _B = B(l) and C = 
C(l)] 



dA 2 



(d- l)C 2fe 



d{d-l)C 2 B 2 



2dA 2 B 2 ' > f(d,e), 



(30) 



where /(d,e) = 8 e" 1 In [2(d - l)/e]. 

Recall now that the positive quantities A 2 — * 0, 
C 2 — * and B 2 — > for fc — > oo. Thus, inequality 
(|30|l can always be satisfied for any fc such that 



dA 2 



{d-l)C 2k 



>/(d,e). 



(31) 



For a given dimension, this latter inequality defines the 
critical number of D-steps fc c , such that for fc > fc c in- 
equality (|3T7|) is satisfied. In particular, solving i|3"T|) with 
respect to fc we obtain 



fc c = log 2 



ln[(d-I)/(d,e)/dn 
ln(A 2 /C) j 



(32) 
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This is a well defined quantity provided that A 2 > C, 
i.e., for 

(poo -poi) 2 > [pxo + (<2- l)pii][poo + (d- l)poi]- (33) 

where Eqs. (|26|l have been used. The same inequal- 
ity holds for isotropic channels but poi = Pio- This is 
therefore a sufficient condition for secret-key distillation 
in the context of any 2d-state QKD protocol under the 
assumption of isotropic quantum channels. In particular, 
it determines the error rates which can be tolerated by 
such protocols using a GL2KD process. 

Recall now that according to Eq. (J5J the estimated 
disturbance for the isotropic channel is D = [1 — poo + 
(d — l) 2 pn]/2. Moreover, due to the normalization con- 
dition inequality l|33[) actually involves two indepen- 
dent parameters (say poo, Pn)- Thus, estimating the val- 
ues of poo which satisfy it, we obtain the tolerable error 
rate (disturbance) which depends on both d and pn, i.e., 
D2cc(d,pn). In fact, we find that D2cc(d,pn) increases 
monotonically with respect to p\\. Hence, the worst-case 
scenario (from Alices's and Bob's point of view) corre- 
sponds to p\\ =0 for which we obtain for the tolerable 
disturbance 



1 - Poo 



2{d- 1) 



id- 1 + + 43' 



(34) 



where D2cc(d) = D2cc(d,pu = 0). Given a particular 
dimension of the information carriers (i.e., a specific 
2d-state protocol), the GL2KD procedure enables Alice 
and Bob to generate a provably secure key whenever 
the estimated disturbance is below D 2 cc(d) or else, the 
quantum channel error rate is below 2£>2Cc(gO- 




10 12 14 16 
Dimension (d) 



FIG. 1: 2d-state QKD protocols : The tolerable error rate 
-D2CC (dashed line) and its theoretical upper bound Dth (solid 
line) as functions of the dimension d. Secret-key distillation is 
impossible in the regime (I), while it may be possible for error 
rates below D t h- In the regime (II) a secret key can be distilled 
by means of the key-distillation procedure considered here. 
Inset: The gap between the two regimes 8(d) = D2CC — Dth 
is plotted as a function of the dimension. The symbols (tri- 
angles, circles and squares) correspond to prime dimensions. 



B. Discussion 

The tolerable disturbance Z?2CC and its theoretical up- 
per bound D t h are plotted as functions of the dimension 
d, in Fig. ^ First of all, we see that £>2Cc(rf) < -Dth for 
all d. Actually the difference between the two bounds 
6(d) = D t h — -D2CC scales with dimension as 



6(d) 



(d-i) (-2 + vms) 

2d(U - 3) 



(35) 



and is also plotted in the inset of Fig. ^ It is also worth 
noting that 6 increases as we go from qubits (d = 2) to 
qutrits (d = 3). It reaches its maximum value around 
d = 4 (i.e., for quatrits) and decreases monotonically for 
higher dimensions. Note that the same behavior also ap- 
pears in the case of (d+ l)-basis protocols 7]. Moreover, 
as d — » 00, we have that 

while 6(d) w 1/4 \fd. In other words, we see that the 
the tolerable error rate for the 2ci-state QKD protocols 
approaches its theoretical upper bound as 1/ \fd for d — > 
00. This is in contrast to the (d + l)-basis protocols 
where the corresponding asymptotic behavior scales with 
dimension as l/d. 

A special case of the isotropic channel we have just 
considered is the so-called depolarizing channel for which 
Pmn = P01 for ( m i n ) 7^ (0, 0). In this case, condition l|33|) 
reduces to Eq. (36) of Ref. i.e., 

(Poo - Pw) 2 > d pio [poa + (d- l)pw] ■ 

Note also that for d = 2 we recover the well-known tol- 
erable error rate of the standard BB84 protocol, i.e., 
C 2 cc(2) -20% HQ. 

In closing, it is worth noting that condition l|33|l c an 
also be obtained by generalizing the ideas of Ref. [6J to 
higher dimensions. More precisely let us define the char- 
acteristic exponent £ R with the defining property 
that there exists an a > such that 



lim 



R 



(fc) 



(36) 



d-l 
d 



R 



(fc) 



where R^ and Rp' are given by Eqs. (fTT|) . respectively. 

For channels satisfying l|25|) . the quantities Rjf' and 

[(d — l)/d] — Rp^ tend to zero from above, as k — > 00. 
Moreover, we obtain the following expression for the 
characteristic exponent 



? (fc) 



'ch 



hi 



Poo + {d- l)poi 



.Pio + (d- l)pi 



In 



Poo + (d- l)poi 
Poo - P11 



Following [3, Eq. (|33|l can now be obtained from the 
condition for asymptotic correctability, that is r 



(d) 

ch 



> 
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2. However, we would like to stress that it is still an 
open problem why this particular correctability condi- 
tion, which was originally derived for qubit-based QKD 
protocols, is also valid for 2d-state protocols and isotropic 
channels. 



V. CONCLUSIONS 

We have discussed the error-tolerance of qudit-based 
QKD protocols using two mutually unbiased (Fourier- 
dual) bases. In particular, we focused on Gottesman-Lo- 
type key-distillation procedures. For arbitrary quantum 
channels subject only to the symmetry between the two 
bases used in the protocol, we derived a sufficient con- 
dition for secret-key distillation, thus extending known 
results on depolarizing quantum channels. 

In the case of isotropic quantum channels, we were able 
to analyze this condition further and to obtain an analyt- 
ical expression for the tolerable error rate as a function 



of the dimension d of the information carriers. Specif- 
ically, as d — ► oo, the tolerable error rate scales with 
dimension as 1/2 — l/iyd, thus approaching its upper 
theoretical bound, that is 1/2. This asymptotic behavior 
is substantially different from the corresponding behav- 
ior in the fully symmetric (d + l)-basis protocols, where 
the tolerable error rate scales as 1 — (3 + Vb)/2d. 

Unfortunately, for moderate values of d, the tolerable 
error rate is always well below its corresponding theoreti- 
cal upper bound D t h{d). Hence, the development of new 
classical key-distillation protocols which will be able to 
bridge this gap still remains an interesting open problem. 
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